copy the shared access signature which is a URL with authorization to download the private blob. Check the start date, don’t add more time than 1 hour for the authorized download window (that would require a policy at the container level, which is more complicated).